cPanel AutoSSL Renewals After Experiencing Failure

Efe K 22 May, 2026 cPanel

AutoSSL runs automatically once every 24 hours on the server. During each run, it checks all domains on the account and attempts renewal if:

• The existing certificate is within days of expiry
• The domain resolves correctly to the hosting server
• The domain is publicly reachable
• DNS and nameservers are correctly configured

If all conditions are met, AutoSSL issues a new certificate and installs it automatically. No downtime occurs.

Common Reasons AutoSSL Fails

1. If the domain no longer points to the hosting server, AutoSSL cannot verify it.

Symptoms:

• AutoSSL log shows “DCV challenge failed”
• Certificate does not renew
• Domain resolves to another provider

Fix:

• Update the DNS A record to point back to the hosting server
• Wait for DNS propagation (usually up to 4 hours)
• Run AutoSSL manually in cPanel (optional)

2. AutoSSL cannot validate or renew certificates for expired domains.

Fix:

• Renew the domain with your registrar
• Wait for DNS to reactivate
• AutoSSL will retry automatically within 24 hours

3. Missing or incorrect A/AAAA records will cause validation to fail.

Fix:

• Ensure the domain and any subdomains point to the correct server IP
• Remove AAAA records if IPv6 is not supported
• Avoid CNAME loops or redirects

4. Existing conflicting DNSSEC record on domain

DS record could prevent domain resolution and AutoSSL can’t validate, thus renewal may fail.

Fix:

• Remove the DS record from the domain registrar
• Re-run AutoSSL

5. The domain is behind a proxy (Cloudflare, CDN, firewall)

Some proxies interfere with DCV (Domain Control Validation).

Fix:

• Ensure Cloudflare “Proxy” is disabled (set to DNS‑only) during renewal
• Or add the required AutoSSL validation exceptions if supported

How to Manually Trigger AutoSSL

You can manually run AutoSSL from within cPanel:

1. Log in to cPanel
2. Go to SSL/TLS Status
3. Click Run AutoSSL

This forces an immediate validation attempt and is useful after fixing DNS issues.

Cleaning Up Old or Invalid Domains

If a domain no longer belongs to you or is no longer hosted on the server, AutoSSL will repeatedly fail for it. Thus Remove the domain from Addon Domains, Subdomains, or Aliases in cPanel.

When to Contact Support

Contact support if:

• AutoSSL continues to fail after DNS is corrected
• You are unsure which DNS records to use
• You require a paid or EV/OV SSL certificate instead of AutoSSL